A role-based user access model is a type of technology control that assigns access rights and permissions to users based on their roles and responsibilities within the organization. A role-based user access model can reduce the likelihood of fraudulent payments committed internally, because it can help to:
Enforce the principle of least privilege, which means that users only have the minimum level of access required to perform their duties Implement segregation of duties, which means that users cannot perform conflicting or incompatible functions, such as initiating and approving payments Prevent unauthorized or inappropriate access to sensitive data or systems, such as payment information or applications Detect and deter fraud attempts by creating audit trails and logs of user activities and transactions Simplify and streamline the management and maintenance of user access rights and permissions, such as adding, modifying, or deleting users or roles12 The other options are not as important as a role-based user access model for reducing the likelihood of fraudulent payments committed internally. Automated access revocation is a technology control that automatically revokes or suspends user access rights and permissions when certain conditions are met, such as termination of employment, change of role, or expiration of password. Automated access revocation can help to prevent fraud by former or inactive users, but it does not address the risk of fraud by current oractive users3. Daily transaction reconciliation is a technology control that compares and verifies the transactions recorded in different systems or sources, such as bank statements and accounting records. Daily transaction reconciliation can help to detect fraud by identifying discrepancies or anomalies in the transactions, but it does not prevent fraud from occurring in the first place4. Rule-based data analytics is a technology control that applies predefined rules or criteria to analyze data and identify patterns, trends, or outliers. Rule-based data analytics can help to monitor fraud by generating alerts or reports of suspicious or unusual transactions, but it does not prevent fraud from happening or being attempted5. References = Role-Based Access Control (RBAC) - ISACA Role-Based Access Control: What It Is and How It Works Automated Access Revocation - ISACA Reconciliation - ISACA Rule-Based Data Analytics - ISACA
[CRISC Review Manual, 7th Edition]